parse url: Characters like < and > has to be escaped when showing the parsed output.

[friendica.git] / mod / parse_url.php

diff --git a/mod/parse_url.php b/mod/parse_url.php
index c8670d4d967fc67b69f66da129a71b60398d6bc0..66ad1e57cec88b05e1dada78a3fb94dcb07eefb3 100644 (file)
--- a/mod/parse_url.php
+++ b/mod/parse_url.php
@@ -50,7 +50,7 @@ function completeurl($url, $scheme) {
         return($complete);
 }
 
-function parseurl_getsiteinfo($url) {
+function parseurl_getsiteinfo($url, $no_guessing = false) {
        $siteinfo = array();
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
@@ -59,7 +59,7 @@ function parseurl_getsiteinfo($url) {
        curl_setopt($ch, CURLOPT_TIMEOUT, 3);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        //curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
-       curl_setopt($ch,CURLOPT_USERAGENT,'Opera/9.64(Windows NT 5.1; U; de) Presto/2.1.1');
+       curl_setopt($ch,CURLOPT_USERAGENT,' Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0');
 
        $header = curl_exec($ch);
        $curl_info = @curl_getinfo($ch);
@@ -75,6 +75,19 @@ function parseurl_getsiteinfo($url) {
                return($siteinfo);
        }
 
+       require_once("include/oembed.php");
+
+       $oembed_data = oembed_fetch_url($url);
+
+       if ($oembed_data->type == "link") {
+               if (isset($oembed_data->title))
+                       $siteinfo["title"] = $oembed_data->title;
+               if (isset($oembed_data->description))
+                       $siteinfo["text"] = $oembed_data->description;
+               if (isset($oembed_data->thumbnail_url))
+                       $siteinfo["image"] = $oembed_data->thumbnail_url;
+       }
+
        // Fetch the first mentioned charset. Can be in body or header
        if (preg_match('/charset=(.*?)['."'".'"\s\n]/', $header, $matches))
                $charset = trim(array_pop($matches));
@@ -184,7 +197,7 @@ function parseurl_getsiteinfo($url) {
                }
        }
 
-       if (@$siteinfo["image"] == "") {
+       if ((@$siteinfo["image"] == "") AND !$no_guessing) {
             $list = $xpath->query("//img[@src]");
             foreach ($list as $node) {
                 $attr = array();
@@ -223,7 +236,7 @@ function parseurl_getsiteinfo($url) {
                                                        "height"=>$photodata[1]);
        }
 
-       if (@$siteinfo["text"] == "") {
+       if ((@$siteinfo["text"] == "") AND (@$siteinfo["title"] != "") AND !$no_guessing) {
                $text = "";
 
                $list = $xpath->query("//div[@class='article']");
@@ -298,9 +311,9 @@ function parse_url_content(&$a) {
        logger('parse_url: ' . $url);
 
        if($textmode)
-               $template = $br . '[bookmark=%s]%s[/bookmark]%s' . $br;
+               $template = '[bookmark=%s]%s[/bookmark]%s' . $br;
        else
-               $template = "<br /><a class=\"bookmark\" href=\"%s\" >%s</a>%s<br />";
+               $template = "<a class=\"bookmark\" href=\"%s\" >%s</a>%s<br />";
 
        $arr = array('url' => $url, 'text' => '');
 
@@ -314,13 +327,15 @@ function parse_url_content(&$a) {
 
        if($url && $title && $text) {
 
-               if($textmode)
-                       $text = $br . '[quote]' . trim($text) . '[/quote]' . $br;
-               else
-                       $text = '<br /><blockquote>' . trim($text) . '</blockquote><br />';
-
                $title = str_replace(array("\r","\n"),array('',''),$title);
 
+               if($textmode)
+                       $text = '[quote]' . trim($text) . '[/quote]' . $br;
+               else {
+                       $text = '<blockquote>' . htmlspecialchars(trim($text)) . '</blockquote><br />';
+                       $title = htmlspecialchars($title);
+               }
+
                $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
 
                logger('parse_url (unparsed): returns: ' . $result);
@@ -331,8 +346,10 @@ function parse_url_content(&$a) {
 
        $siteinfo = parseurl_getsiteinfo($url);
 
+       $sitedata = "";
+
        if($siteinfo["title"] == "") {
-               echo sprintf($template,$url,$url,'') . $str_tags;
+               $sitedata .= sprintf($template,$url,$url,'') . $str_tags;
                killme();
        } else {
                $text = $siteinfo["text"];
@@ -364,20 +381,24 @@ function parse_url_content(&$a) {
 
        if(strlen($text)) {
                if($textmode)
-                       $text = $br.'[quote]'.trim($text).'[/quote]'.$br ;
+                       $text = '[quote]'.trim($text).'[/quote]';
                else
-                       $text = '<br /><blockquote>'.trim($text).'</blockquote><br />';
+                       $text = '<blockquote>'.htmlspecialchars(trim($text)).'</blockquote>';
        }
 
        if($image) {
                $text = $br.$br.$image.$text;
        }
+
        $title = str_replace(array("\r","\n"),array('',''),$title);
 
        $result = sprintf($template,$url,($title) ? $title : $url,$text) . $str_tags;
 
        logger('parse_url: returns: ' . $result);
 
-       echo trim($result);
+       $sitedata .=  trim($result);
+
+       echo "[class=type-link]".$sitedata."[/class]";
+
        killme();
 }